Search the VMware Knowledge Base (KB)
View by Article ID

Upgrade from vSphere 5.1 to vSphere 5.5 rolls back after importing Lookup Service data (2060511)

  • 57 Ratings


  • For some vSphere 5.1 installations, when upgrading from vSphere 5.1 to vSphere 5.5, the VMware vCenter Single Sign-On (SSO) upgrade rolls back and the upgrade fails.
  • The vim-sso-msi.log file, located at %temp% ,you see entries similar to:

    • Action TIME: PostInstallScripts. Importing Lookupservice data...
      CustomAction DoUpdateAndMigrateTasks returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
    • MSI (s) (0C:E8) [TIME]: Hello, I'm your 64bit Elevated custom action server.
      Action 08:55:54: PostInstallScripts. Configuring SSO Components...
      PostInstallScripts: PostInstallScripts
      PostInstallScripts: PostInstallScripts
      PostInstallScripts: PostInstallScripts
      CustomAction BootstrapAll returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
      Action ended 08:56:09: InstallFinalize. Return value 3.
      MSI (s) (0C:B4) [08:56:09:908]: User policy value 'DisableRollback' is 0


The SSO upgrade fails if there is a mismatch between the certificate for the 5.1 SSO service and a related registry key that indicates that the system is DNS-enabled.

Note: This issue does not affect you if:
  • You are using custom certificates.
  • You are performing a fresh install of vCenter Server 5.5.
  • You are upgrading from vCenter Server 4.x/5.0 or a fresh installation of vCenter Server 5.1 Update 1a or later.


This issue is resolved in vCenter Server 5.5.0a. With this release, if the SSL certificates use an IP address, the installation displays the message:

Setup has detected a problem with your current configuration which will cause upgrade to fail. See VMware KB article 2060511.

Your current configuration uses an IP address. vCenter Single Sign-On requires an FQDN to continue. Setup has detected for your machine. Click Accept to use instead of the IP address.

You must click Accept to continue with the installation. 

To work around this issue when an upgrade from vCenter Server 5.1 to 5.5 failed and the upgrade is rolled back, remove the left over upgrade files before proceeding.

To remove left over upgrade files:

Note: This procedure modifies the Windows registry. Before making any registry modifications, ensure that you have a current and valid backup of the registry and the virtual machine. For more information on backing up and restoring the registry, see Microsoft Knowledge Base article 136393.

Note: The links in this article were correct as of August 5, 2014. If you find a link is broken, provide feedback and a VMware employee will update the link.

  1. Remove the CIS folder located at:


    For example, remove the C:\ProgramData\Vmware\CIS folder.

  2. Set the value of the HKEY_LOCAL_MACHINE\Software\VMware, Inc.\VMware Infrastructure\SSOServer\FQDNIP registry key to the FQDN value that is referenced in the SSL certificate for your vCenter 5.1 Single Sign-On service. The FQDN value is found either in the Subject Name field or as a DNS Name= entry in the multi-entry Subject Alt Name field of the certificate.
  3. Restart your vCenter Server 5.5 upgrade.

Additional Information

To be alerted when this article is updated, click Subscribe to Document in the Actions box.

See Also

Update History

09/24/2013 - Added more detailed info and workaround. 11/07/2013 - Issue resolved in vCenter Server 5.5.0a

Request a Product Feature

To request a new product feature or to provide feedback on a VMware product, please visit the Request a Product Feature page.


  • 57 Ratings

Did this article help you?
This article resolved my issue.
This article did not resolve my issue.
This article helped but additional information was required to resolve my issue.

What can we do to improve this information? (4000 or fewer characters)

Please enter the Captcha code before clicking Submit.
  • 57 Ratings